Privacy Policy

1. Who we are

TechToony FZC (“TechToony”, “we”, “our”, “us”) is a UAE-registered company that builds AI-powered conversational software, including the TalkMyBot WhatsApp, voice, and IVR platform. This Privacy Policy explains how we collect, use, and protect personal information when you interact with our website, our platform, or with the AI assistants we operate on behalf of our business customers.

2. Scope

This policy applies to:

• Visitors to techtoony.com and talkmybot.com.
• Business customers who sign up for the TalkMyBot dashboard or other TechToony services.
• End-customers (the people of our business customers) who message a WhatsApp bot, call an IVR, or chat with any conversational interface we operate.

When you message a bot built and operated by us for one of our business customers, that business customer is the data controller of your conversation and TechToony is the data processor acting on their instructions. The business customer’s own privacy policy may also apply to that interaction.

3. Information we collect

3.1 Information you give us

• Account information: name, email address, business name, billing address, and password (stored as a one-way hash).
• Demo / contact requests: name, email, phone number, and the message you submit.
• Payment details: handled by our payment partner Polar.sh — we do not store full card numbers.

3.2 Information collected through WhatsApp, voice, or other channels

• Messages and media you send (text, images, voice notes, location pins, payment receipts).
• Your WhatsApp display name and phone number, as provided by the Meta WhatsApp Business Platform.
• Conversation metadata: timestamps, message IDs (wamids), delivery status.
• Order details you provide during a transaction: items, quantities, delivery address, payment method.
• Voice call metadata for IVR / voice-bot services: caller ID, call duration, the option you selected, optional call recording where the customer has consented.

3.3 Information collected automatically

• Usage data: pages viewed, features used, time spent.
• Device and log data: IP address, browser, operating system, referrer URL.
• Cookies and similar technologies on our websites for session management and basic analytics.

4. How we use the information

We use personal information to:

• Provide the TalkMyBot service: reply to customer messages, take orders, send payment links and order confirmations.
• Operate IVR and voice services on behalf of our business customers.
• Show business customers a dashboard of their conversations, orders, and analytics.
• Train and improve our AI prompts and routing logic (using anonymised or aggregated data wherever feasible).
• Process payments and prevent fraud.
• Send you transactional emails about your account, billing, and important changes.
• Respond to your support, sales, or partnership enquiries.
• Comply with legal obligations.

We do not sell your personal information. We do not use end-customer message content to advertise to that end-customer.

5. Legal basis for processing (GDPR / UAE PDPL)

Where applicable, we rely on the following lawful bases:

• Performance of a contract — to provide the service you signed up for.
• Legitimate interests — to operate, secure, and improve our platform.
• Consent — for optional features such as marketing emails or call recording.
• Legal obligation — to keep records required by tax, accounting, or law-enforcement requests.

6. Who we share information with

We share personal information with a limited set of providers and parties:

• Meta Platforms (WhatsApp Business Platform) — to send and receive WhatsApp messages on behalf of our business customers.
• Anthropic (Claude API) — to generate conversational responses. Anthropic processes messages on a zero-retention basis under their commercial terms.
• OpenAI — used only for embedding-based search where enabled.
• Polar.sh — payment processing and subscription management.
• Resend — transactional email delivery.
• DigitalOcean — server hosting (EU and US regions).
• Twilio — voice and SMS, where used for IVR services.
• Business customers — the merchant whose bot you are messaging will see your conversation in their dashboard.
• Authorities — where required by law or to protect rights, safety, or property.

We share only the information each provider needs, and each provider is bound by appropriate confidentiality and data-protection terms.

7. Data retention

• Account data: kept for as long as your account is active, then deleted within 90 days of closure (or longer where required by law).
• Conversation history: retained for as long as the business customer’s subscription is active. End-customers can request earlier deletion (see section 9).
• Order records: retained for up to 7 years for tax and accounting compliance.
• Logs: server and webhook logs are kept for up to 30 days, then rotated.
• Backups: encrypted backups may persist for up to 60 days before being overwritten.

8. Security

We take the following measures, among others:

• TLS encryption in transit for all websites and API endpoints.
• Database access restricted to private network interfaces.
• Passwords stored as bcrypt hashes; webhook payloads verified with HMAC-SHA256 signatures.
• Secrets (API keys, tokens) stored encrypted at rest with AES-256-GCM.
• Role-based access on the dashboard (owner, admin, staff).
• Regular software updates and dependency monitoring.

No method of transmission or storage is 100% secure. We will notify affected parties and relevant authorities of any qualifying personal-data breach within the timeframes required by applicable law.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion (“right to be forgotten”).
• Restrict or object to certain processing.
• Receive a copy of your information in a portable format.
• Withdraw consent at any time (where processing was based on consent).
• Lodge a complaint with a data-protection authority.

To exercise any of these rights, contact us at the address in section 13. If your data was collected through a bot operated for a business customer, please also contact that business customer directly — they may need to authorise the action.

10. International data transfers

We are based in the United Arab Emirates, and our service providers operate servers in the UAE, the EU, the United Kingdom, and the United States. Where personal information is transferred outside your country of residence, we rely on legally recognised transfer mechanisms such as Standard Contractual Clauses and equivalent adequacy frameworks.

11. Children

Our services are not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect information from children. If you believe a child has provided us with information, please contact us so we can delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top and, for material changes, notify business-customer admins by email. Your continued use of our services after a change indicates your acceptance of the updated policy.

13. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact:

• TechToony FZC
• Email: [email protected]
• Website: techtoony.com
• Product: talkmybot.com

We aim to respond to all data-subject requests within 30 days.